caddyhttp: shield specific hostnames from a covering wildcard's client auth - #7920
Open
SillyZir wants to merge 1 commit into
Open
caddyhttp: shield specific hostnames from a covering wildcard's client auth#7920SillyZir wants to merge 1 commit into
SillyZir wants to merge 1 commit into
Conversation
…t auth
A connection policy for a wildcard hostname (e.g. *.example.com with
client_auth) is first-match by SNI, so it also applied client
authentication to more specific hostnames served by their own site
blocks (public.example.com) — sites that never asked for mTLS.
Two cases produce the shielding empty policy that fixes this:
- site blocks whose TLS config yields a connection policy with no
settings (previously discarded as having no effect);
- site blocks with no TLS connection policy at all — the reported
case — for which an empty policy is now synthesized.
Either way the empty policy is hoisted directly above the first
client-auth-bearing policy whose wildcard SNI covers the hostname, so
first-match shields it from the client-auth requirement.
Deliberately scoped to client authentication: other wildcard policy
settings, such as certificate selection, are ones a covered hostname
generally WANTS to inherit (see tls_automation_wildcard_shadowing);
sni matchers that fail to decode emit an adapt warning instead of
being silently skipped.
Fixes caddyserver#7860
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #7860.
TLS connection policies are first-match by SNI, so a policy for a wildcard hostname (
*.example.comwithclient_auth) also applied client authentication to more specific hostnames served by their own site blocks (public.example.com) — sites that never asked for mTLS.The adapter now emits an empty shielding connection policy for such hostnames, hoisted directly above the first client-auth-bearing policy whose wildcard SNI covers them, so first-match exempts them from the client-auth requirement. Two cases produce the shield:
Deliberately scoped to client authentication. Other wildcard policy settings — certificate selection in particular — are ones a covered hostname generally wants to inherit (the
tls_automation_wildcard_shadowingbehavior is preserved and its fixture still passes unchanged). Client auth is the setting that inverts the security posture of a site that never configured it, so only that triggers shielding. SNI matchers that fail to decode now emit an adapt warning rather than being silently skipped.The new adapt fixture (
tls_client_auth_wildcard_not_inherited_by_specific_host.caddyfiletest) covers the exact scenario from the issue: with this change the specific hostname's empty policy precedes the wildcard's client-auth policy; on master no such policy is emitted at all. Fullcaddyfile_adaptsuite andcaddyconfigpackage tests pass.Files:
caddyconfig/httpcaddyfile/httptype.go,caddytest/integration/caddyfile_adapt/tls_client_auth_wildcard_not_inherited_by_specific_host.caddyfiletestAssistance Disclosure
This patch was developed with AI assistance. It was reviewed and tested before submission (affected package tests pass), and is submitted from a human-owned account that takes responsibility for the change.